Question

A cloud operations team maintains an approved configuration baseline for all production Linux instances, including required kernel hardening parameters and disabled legacy services. During a routine automated scan, the configuration management database (CMDB) reveals that 12 instances in an auto-scaling group have deviated from the baseline: an outdated SSH cipher suite has been re-enabled and a firewall rule was manually modified. The change is not documented in any change ticket. According to sound configuration management practice, what should the team do FIRST?

Accepted Answer

Automatically re-apply the approved baseline configuration to the drifted instances and open a problem record to investigate the source of the unauthorized change

Answer

Update the configuration baseline to reflect the current running state of the 12 instances so the CMDB no longer reports drift

Answer

Immediately terminate the 12 instances and let the auto-scaling group launch fresh replacements from the trusted image

Answer

Submit a retroactive emergency change request to legitimize the modified SSH cipher and firewall rule before the next audit